⬢ DragonFlyBSD Kernel Audit
DF-5541 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
--- sys/bus/gpio/gpio_intel/gpio_intel.c
+++ sys/bus/gpio/gpio_intel/gpio_intel.c
@@ -235,6 +235,13 @@
 				*cookiep = map;
 				map->arg = NULL;
 				map->handler = NULL;
+			} else {
+				/*
+				 * Backend returned success without
+				 * registering a map; do NOT report
+				 * success with *cookiep untouched.
+				 */
+				ret = ENXIO;
 			}
 		}
 	} else {
@@ -253,7 +260,11 @@
 	struct gpio_intel_softc *sc = device_get_softc(dev);
 	struct pin_intr_map *map = (struct pin_intr_map *)cookie;
 
-	KKASSERT(gpio_intel_pin_exists(sc, map->pin));
+	if (map->pin < 0 || !gpio_intel_pin_exists(sc, map->pin)) {
+		device_printf(sc->dev, "%s: stale cookie (pin %d not mapped)\n",
+		    __func__, map->pin);
+		return;
+	}
 
 	lockmgr(&sc->lk, LK_EXCLUSIVE);
 	map->arg = NULL;
@@ -269,7 +280,8 @@
 	struct gpio_intel_softc *sc = device_get_softc(dev);
 	struct pin_intr_map *map = (struct pin_intr_map *)cookie;
 
-	KKASSERT(gpio_intel_pin_exists(sc, map->pin));
+	if (map->pin < 0 || !gpio_intel_pin_exists(sc, map->pin))
+		return;
 
 	lockmgr(&sc->lk, LK_EXCLUSIVE);
 	map->arg = arg;
@@ -284,7 +296,8 @@
 	struct gpio_intel_softc *sc = device_get_softc(dev);
 	struct pin_intr_map *map = (struct pin_intr_map *)cookie;
 
-	KKASSERT(gpio_intel_pin_exists(sc, map->pin));
+	if (map->pin < 0 || !gpio_intel_pin_exists(sc, map->pin))
+		return;
 
 	lockmgr(&sc->lk, LK_EXCLUSIVE);
 	sc->fns->disable_intr(sc, map);
@@ -303,6 +316,9 @@
 	if (cookiep == NULL)
 		return (EINVAL);
 
+	/* pin_exists() narrows pin to uint16_t; reject wider values. */
+	if (pin > 0xFFFF)
+		return (ENOENT);
 	if (!gpio_intel_pin_exists(sc, pin))
 		return (ENOENT);